Event shows hexadecimal when importing

[madmoravian]

I've got an event log from a sql server that I'm trying to import. When I view the file in a text editor, everything looks readable. When I preview the data in splunk it looks like this:

\x002\x000\x001\x003\x00-\x000\x003\x00-\x000\x004\x00 \x000\x008\x00:\x004\x003\x00:\x005\x004\x00.\x009\x005\x00 \x00L\x00o\x00g\x00o\x00n\x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00L\x00o\x00g\x00i\x00n\x00 \x00s\x00u\x00c\x00c\x00e\x00e\x00d\x00e\x00d\x00 \x00f\x00o\x00r\x00 \x00u\x00s\x00e\x00r\x00 \x00'\x00S\x00E\x00T\x00S\x00D\x00B\x00'\x00.\x00 \x00C\x00o\x00n\x00n\x00e\x00c\x00t\x00i\x00o\x00n\x00:\x00 \x00n\x00o\x00n\x00-\x00t\x00r\x00u\x00s\x00t\x00e\x00d\x00.\x00 \x00[\x00C\x00L\x00I\x00E\x00N\x00T\x00:\x00 \x001\x000\x00.\x001\x00.\x002\x005\x00.\x001\x007\x00]\x00

Any thoughts?

Scott

[sbrant_splunk]

This seems to be an encoding mismatch. These should provide some insight:

http://docs.splunk.com/Documentation/Splunk/5.0.2/data/Configurecharactersetencoding

http://wiki.splunk.com/Community:WindowsCharacterEncoding